Scenario practice questions

An organization implements strict role-based access control and regular auditing

Why it fails: Role-based access control with auditing is a defensive control, not an attack against end users. It tempts because it concerns access and identity, the same territory attackers target, but the stem asks for offensive scenarios such as phishing or credential theft, so a mitigation cannot qualify.

A network administrator configures automated offboarding checklists for departed employees

Why it fails: Automated offboarding checklists are an administrative control that removes access, not an attack on end users. It tempts because departed-employee accounts are a genuine attack vector, but the checklist itself is the defence, whereas the stem requires scenarios describing attacks such as phishing or pretexting.

Network segmentation compliance

Why it fails: Network segmentation limits lateral movement between systems, so it cannot address paper left on a printer tray. It is tempting because segmentation is a genuine control for containing breaches, and would be the right answer if the scenario involved unauthorised access spreading across VLANs.

Endpoint firewall configuration

Why it fails: Endpoint firewall configuration governs host traffic, not physical documents, so it cannot prevent exposure of printed records. It is tempting because endpoint firewalls are a real control for restricting outbound connections, and would be correct if the scenario involved a compromised workstation reaching command-and-control servers.

Multi-factor authentication protocols

Why it fails: Multi-factor authentication governs logical access to systems and has no bearing on paper documents left on a printer, which is a clear-desk and secure-handling issue. MFA is the correct control when protecting accounts from credential theft, not when preventing physical exposure of printed records.

Watering hole attack

Why it fails: A watering hole compromises a website frequented by a target group so visitors are infected; no website is involved here, only a voice call soliciting a password. It would be correct if victims were infected after visiting a trusted but compromised site.

Phishing via SMS (Smishing)

Why it fails: Smishing delivers fraudulent messages through SMS text messaging, whereas this attack arrives as a live voice call, making the delivery channel wrong. It would be correct if the same pretext reached the user as a deceptive text message on their phone.

Credential stuffing

Why it fails: Credential stuffing replays username and password pairs already breached elsewhere against login services; it is automated and involves no interaction with the victim. It would be correct if attackers were testing leaked credential lists against the corporate sign-in portal.

Explicit Proxy Mode

Why it fails: Explicit proxy mode forwards web traffic through a proxy configuration and provides no SSL VPN login portal or resource bookmarks. It is tempting because it is browser-based, but explicit proxy governs outbound web access rather than offering clientless remote-access portal sessions.

IPsec Client Mode

Why it fails: IPsec client mode requires the FortiClient application and establishes a tunnel, so it cannot deliver a browser-only portal with bookmarks. It is tempting because IPsec also provides remote access, but that is for pre-installed client tunnels rather than clientless web-mode access.

SSL VPN Tunnel Mode

Why it fails: Tunnel mode needs FortiClient installed and routes traffic through a virtual adapter, so no customised browser portal with bookmarks is presented. It is tempting because it also uses SSL, but tunnel mode targets full network access via client, not clientless web-mode browsing.

Man-in-the-middle interception of wireless frames.

Why it fails: Man-in-the-middle interception requires an adversary positioned between two communicating parties to capture or alter traffic; plugging in a found drive involves no network session. It is tempting because both are common attack categories, and MITM would be correct if wireless frames were being intercepted on the network path.

Cross-site scripting executed within a browser session.

Why it fails: Cross-site scripting injects malicious script into a trusted web page, executing in the victim's browser session; the USB drive involves no web page or browser. It is tempting because both exploit user trust, and XSS would be correct if attacker-supplied script ran within a site the employee visited.

Watering hole attack targeting web browsing habits.

Why it fails: A watering hole attack compromises websites a target group is known to frequent, infecting visitors through their browsers; no web browsing occurs here. It is tempting because both are delivery vectors, and watering hole would be correct if the employee were infected while visiting a legitimate but compromised site.

Availability, because public networks are prone to high latency and packet loss.

Why it fails: Availability concerns uptime and reachability of resources, not the exposure of data on an untrusted medium. Latency and packet loss on public Wi-Fi do not represent the primary breach; confidentiality is lost because traffic is unencrypted and interceptable by nearby attackers.

Non-repudiation, because transactions cannot be cryptographically verified.

Why it fails: Non-repudiation concerns proving a party performed an action, typically via digital signatures or audit logs; it is not the principle breached by unencrypted traffic. The compromise here is confidentiality, since credentials and data traverse an open network where they can be intercepted.

Integrity, because unauthorized users can modify corporate files in transit.

Why it fails: Integrity covers unauthorised modification of data, which requires an active man-in-the-middle altering traffic; passive interception on open Wi-Fi is the more immediate risk. The primary compromise is confidentiality, as credentials and corporate data are exposed in cleartext without VPN encryption.

A SQL injection exploit

Why it fails: SQL injection targets database-driven web applications by inserting malicious query syntax; it does not produce browser pop-ups or phone numbers. It tempts as a recognised web attack, but the scenario describes tech-support scareware, a social-engineering scam.

A distributed denial-of-service attack

Why it fails: A DDoS attack floods a service with traffic to exhaust its capacity, so it cannot generate browser pop-ups or toll-free support prompts. It is tempting because both involve malicious internet activity, but DDoS would be the answer if the scenario described degraded availability rather than a social-engineering lure.

A legitimate endpoint telemetry notification

Why it fails: Legitimate endpoint telemetry arrives through managed security agents and consoles, never as unsolicited browser pop-ups demanding a phone call. It is tempting because genuine alerts do report infections, but that would fit a scenario where a known EDR or antivirus tool surfaces a verified detection to an administrator.

Endpoint compliance

Why it fails: Endpoint compliance concerns the configuration and health of managed devices such as laptops and servers, not a hardware reader at a doorway. It would be the correct aspect if the tampering involved an unpatched workstation or missing endpoint agent on a corporate machine.

Network layer security

Why it fails: Network layer security covers traffic inspection, segmentation and protocol attacks, whereas the badge reader and recording device are physical artefacts at the entrance. It would be correct if the attacker intercepted or spoofed network traffic to reach internal systems.

Application layer security

Why it fails: Tampering with a badge reader and attaching a recording device is a physical attack on the entry point, not exploitation of software flaws such as injection or insecure APIs. Application layer security would be the answer if the attacker targeted a web application's input handling instead.

An attacker leaves a malicious USB drive in the lobby.

Why it fails: Dropping a USB drive relies on the victim's curiosity to trigger physical media insertion, with no fabricated narrative or assumed identity. Pretexting requires a invented scenario establishing trust; a baiting scenario is what this option actually describes.

An attacker uses automated software to guess passwords.

Why it fails: Automated password guessing is a brute-force attack against authentication, involving no human dialogue or fabricated identity. Pretexting depends on a plausible invented story delivered to a person; this option describes a technical, non-interactive credential attack instead.

An attacker shoulder-surfs to capture a password.

Why it fails: Shoulder-surfing is a physical observation technique, not a pretexted scenario.

An attacker installs a keylogger on an unattended physical workstation in an office.

Why it fails: Installing a keylogger on an unattended workstation is physical intrusion and credential capture, involving no fabricated persona or verbal manipulation. It is tempting because it is a real insider-style attack, and would be correct if the question concerned physical access threats rather than pretexting.

An attacker floods a web server with synthetic traffic to crash the service.

Why it fails: Flooding a server with synthetic traffic is a denial-of-service attack, relying on volume rather than a fabricated believable story to manipulate a person. It is tempting because it is a genuine attack technique, and would be correct if the question asked about availability attacks instead of human deception.

An attacker sends mass emails containing a malicious macro-enabled attachment.

Why it fails: Mass emails with macro attachments are phishing or malware delivery, exploiting curiosity rather than a constructed false identity and scenario. It is tempting because phishing overlaps with social engineering, and would be correct if the question asked about malicious attachment campaigns rather than pretexting.

A distributed denial-of-service attack flooding servers.

Why it fails: A DDoS attack exhausts bandwidth or connection state by flooding servers from many sources, denying availability rather than modifying message content. It would be correct if the scenario described service outage under volumetric traffic, not an adversary relaying and altering communications while impersonating both endpoints.

A zero-day exploit leveraging unpatched software code.

Why it fails: A zero-day exploit abuses an unknown, unpatched software vulnerability to gain code execution or escalate privileges; it does not require intercepting and rewriting traffic between two parties. It would be the answer if the stem described compromise via a previously unknown flaw with no available fix.

A brute-force attack guessing login credentials.

Why it fails: Brute-force attacks systematically guess credentials to gain unauthorised account access; they do not sit between two parties rewriting messages. It would be the answer if the stem described repeated login attempts against an authentication endpoint, not interception and alteration of an established communication channel.

Firewall policy source IP object

Why it fails: Firewall policy source IP objects are referenced inside firewall policies, not when creating a local administrator account. It is tempting because admin trusthosts also restrict source addresses, but those are configured as trusthost entries on the admin account itself.

DHCP lease pool range

Why it fails: A DHCP lease pool range belongs to interface DHCP server configuration, not administrator account creation; the account form instead requires a username and configurable admin profile. It is tempting because DHCP settings are configured on the FortiGate, but they define address assignment for clients, not operator privileges or authentication.

SSL VPN portal bookmark

Why it fails: An SSL VPN portal bookmark is configured within the VPN portal to publish internal web or file resources to remote users, and has no bearing on local administrator account creation. It is tempting because both appear under system-level configuration, yet bookmarks serve remote-access convenience rather than defining operator credentials or privilege profiles.

Blocking all external incoming emails entirely

Why it fails: Blocking all external email removes the attack vector but teaches nothing, so staff never practise judging genuine messages. It is tempting as a zero-risk control, yet it is correct only where mail flow is entirely internal and no external correspondence is required.

Restricting employees from having LinkedIn or social media accounts

Why it fails: Banning social media removes the very reconnaissance data attackers exploit, but employees still face spear-phishing at work and home; it also harms legitimate networking. Acceptable-use policies governing what staff publish publicly are the real control, not prohibition of accounts.

Requiring employees to read a 100-page security policy manual annually

Why it fails: Reading a policy manual conveys declarative knowledge of rules, not the pattern-recognition skill needed to spot personalised spear-phishing lures. Manuals suit compliance attestation, where an auditor needs documented acknowledgement of acceptable-use or data-handling rules. Building practical resilience requires simulated phishing campaigns with immediate teachable-moment feedback, which this approach cannot deliver.

MAC flooding attack

Why it fails: MAC flooding overwhelms a switch's CAM table so it fails open and floods frames, enabling sniffing; it does not relay and alter traffic between two hosts. The described relay-and-modify behaviour is an on-path (man-in-the-middle) attack, which MAC flooding may merely facilitate.

Distributed denial of service

Why it fails: A distributed denial of service exhausts bandwidth or connection state to make a service unavailable; it never relays or modifies messages between two hosts. The interception, relaying and alteration described is an on-path (man-in-the-middle) attack, so DDoS fails to match the scenario.

SQL injection exploit

Why it fails: SQL injection inserts malicious SQL through unsanitised input to manipulate a database; it does not sit between two communicating hosts relaying and modifying their traffic. The described interception and alteration is an on-path (man-in-the-middle) attack, a different layer entirely.

The Web Filtering license on the FortiGate has expired, causing HTTPS inspection to fail open.

Why it fails: An expired Web Filtering licence disables category-based blocking and FortiGuard lookups, but HTTPS inspection itself continues using the local CA certificate; browsers warn because they distrust that certificate, not because licensing lapsed. The licence matters when URL filtering categories must be enforced.

The firewall policy is configured with proxy-based inspection instead of flow-based inspection.

Why it fails: Proxy-based inspection terminates the TLS session and re-signs with the FortiGate CA, so browsers trust it only if that CA is installed; the scenario's warnings on internal apps point to certificate trust, not inspection mode. Flow-based inspection is chosen for throughput, not to prevent warnings.

The Antivirus database update failed, preventing the FortiGate from decrypting TLS 1.3 handshakes.

Why it fails: Antivirus database updates are unrelated to TLS decryption; deep inspection uses the FortiGate's certificate and CA chain, so browser warnings arise when the inspection CA is not trusted by the client or the certificate is mismatched. It is tempting because update failures do cause inspection problems, but not certificate trust errors.

Physical shoulder surfing

Why it fails: Shoulder surfing is visual observation of a screen or keypad by someone physically nearby; it involves no website, browser or executable download. It is tempting because it is also silent and user-unaware, but the mechanism is direct physical observation, not an automatic drive-by download triggered by a malicious site.

Social engineering phone call

Why it fails: A social engineering phone call relies on human manipulation through voice contact, so it cannot describe an automated browser download requiring no user interaction. It is tempting because social engineering also targets users silently, but the mechanism is deception of a person, not drive-by download of an executable.

Email phishing scam

Why it fails: Email phishing delivers a lure through a message that persuades the recipient to click or open an attachment, requiring user action. It is tempting because phishing also spreads malware silently, but the mechanism is deceptive email content, not a browser blocking an automatic executable download from a visited site.

Bandwidth saturation anomaly

Why it fails: Impossible-travel detection compares authentication geolocation and timing, so it is a user-behaviour or access anomaly, not a throughput measurement. Bandwidth saturation monitoring tracks link utilisation and packet loss against capacity thresholds; it would be the right control when investigating slow transfers or congested WAN circuits.

Hardware failure indicator

Why it fails: Hardware failure produces crashes, errors, or availability loss, not successful logins from two geographically impossible locations. It is tempting because hardware faults are a common log anomaly, but the evidence here points to compromised credentials being replayed, which is an identity-based anomaly.

DNS poisoning event

Why it fails: DNS poisoning redirects name resolution to fraudulent IP addresses; it does not produce successful authentications from two distant locations. It is tempting because poisoning is a genuine account-compromise vector, but impossible-travel logins indicate credential theft or session hijacking, not resolver manipulation.

FortiClient

Why it fails: FortiClient is an endpoint security agent that provides antivirus, web filtering, and VPN capabilities on user devices. It does not perform sandboxing on the network level. While it can detect known malware, it does not detonate files in a sandbox to find zero-day threats. The administrator needs a network-based sandbox solution.

FortiManager

Why it fails: FortiManager is used for centralized management of FortiGate devices. It does not have sandboxing features. It can push configuration and policies, but it cannot analyze files for zero-day threats. The requirement is for sandboxing, which is outside FortiManager's scope.

FortiAnalyzer

Why it fails: FortiAnalyzer is a log collection and reporting platform. It does not perform sandboxing or file detonation. While it can store logs from FortiSandbox and FortiGate, it does not provide the sandboxing capability itself. The administrator needs a dedicated sandbox product, not a logging and analytics tool.